Skip to content
Fencer Vulns
medium 6.1

CVE-2018-12099 json

Grafana Cross-site Scripting (XSS)

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also GHSA-v5gq-qvjq-8p53 , GO-2024-2510 , EUVD-2024-0432

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

Patch / fix

  • go github.com/grafana/grafana 5.2.0-beta1, 5.2.0-beta1+incompatible
  • ceph ceph storage 3 2:12.2.8-128.el7cp
  • grafana ceph storage 3 5.2.4-2.el7cp
  • librbd1 ceph storage 3 2:12.2.8-128.el7cp
  • librgw2 ceph storage 3 2:12.2.8-128.el7cp
  • ceph-mds ceph storage 3 2:12.2.8-128.el7cp
  • ceph-mgr ceph storage 3 2:12.2.8-128.el7cp
  • ceph-mon ceph storage 3 2:12.2.8-128.el7cp
  • ceph-osd ceph storage 3 2:12.2.8-128.el7cp

red hat advisories RHSA-2019:0911

  • grafana Enterprise Storage 5 4.6.5-3.10.1
  • logstash OpenStack Cloud 7 2.4.1-5.1
  • monasca-installer OpenStack Cloud 7 20180608_12.47-9.1
  • kafka OpenStack Cloud 7 0.10.2.2-5.1
  • grafana OpenStack Cloud 7 4.5.1-1.8.1
  • openstack-monasca-installer OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 20180622_15.06-3.6.1
  • kafka OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.9.0.1-5.3.1
  • grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.5.1-4.3.1

suse advisories SUSE-SU-2020:1273-1SUSE-SU-2018:2536-1SUSE-SU-2018:2317-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12099 updated cvss 6.8

grafana: Cross-site Scripting (XSS) in dashboard links

  • Red Hat Ceph Storage 2 grafana Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 3.2 MON ceph 12.2.8-128.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-mgr 12.2.8-128.el7cp, ceph-mon 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, +10 more Red Hat Ceph Storage 3.2 OSD ceph 12.2.8-128.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-osd 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, ceph-test 12.2.8-128.el7cp, +9 more Red Hat Ceph Storage 3.2 Tools ceph 12.2.8-128.el7cp, grafana 5.2.4-2.el7cp, librbd1 12.2.8-128.el7cp, librgw2 12.2.8-128.el7cp, ceph-mds 12.2.8-128.el7cp, ceph-base 12.2.8-128.el7cp, +13 more
    fixed: vendor fix RHSA-2019:0911
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools grafana Red Hat OpenStack Platform 8 (Liberty) Operational Tools grafana Red Hat OpenStack Platform 9 (Mitaka) Operational Tools grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/grafana/grafana/pull/11813 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
<5.2.0-beta1
<5.2.0-beta1+incompatible
5.2.0-beta1
5.2.0-beta1+incompatible

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.